A Business Associate Agreement is a contract HIPAA requires between a healthcare provider and any outside company that handles protected health information on its behalf. It sets out how the vendor may use that information, what safeguards it must maintain, and how it must report a breach.
Also called: BAA, business associate contract
When is a BAA required?
A BAA is required by any vendor who creates, receives, stores, or transmits PHI for a covered entity, such as a healthcare provider. Examples of vendors that tend to need BAAs include scheduling partners, call centers, billing companies, and software platforms.
What does a BAA typically cover?
- Permitted uses of PHI: Based on the services they provide, what is a vendor allowed to do with the data?
- Required safeguards: Meeting HIPAA’s Security Rule, which requires administrative, physical, and technical safeguards against data breaches.
- Breach reporting: How quickly and in what amount of detail is the vendor required to report security incidents or data breaches?
- Subcontractor obligations: Holding any subcontracted organizations that handle PHI to the same obligations, restrictions, and regulations as the vendor.
- Returning or destroying data: When the contract ends, vendors are required to return or destroy any PHI they still have access to.
BAAs in patient access outsourcing
Outsourced teams need to have a signed BAA before they can see or access any patient records. Any subcontractors that work with the vendor will also need to sign their own BAAs. It’s important to note that having a BAA is not proof of a vendor’s HIPAA compliance, but a legal agreement requiring it.
How do I hand off patient scheduling and intake without violating HIPAA?
BAA vs. HITRUST certification vs. SOC 2
- BAA: A legal contract between a healthcare provider and any outsourcing partner who handles PHI, promising HIPAA compliance.
- HITRUST certification: An optional certification that provides independent assurance that an organization follows standards conducive to HIPAA compliance.
- SOC 2: An audit report that evaluates the quality of a service organization’s security controls.
FAQs
Who is responsible if a business associate has a breach?
Possibly both. Since the HITECH Act, business associates are held directly liable for their own compliance with HIPAA’s Security Rule, Breach Notification Rule, and some requirements of the Privacy Rule. In the event of a breach, business associates can face penalties of their own from the Office of Civil Rights, no matter what is actually stipulated in the contract.
Healthcare providers are considered the “covered entity” under HIPAA. As such, they remain responsible for notifying any affected individuals after a breach, notifying the HHS, and sometimes even the media. Business associates on the other hand are required to notify the provider in a timely fashion, within 60 days of discovering a breach. The BAA may specify a shorter deadline. In cases where the vendor was acting as the provider’s agent, the provider can be held directly liable. A quality BAA can sort out specifically who is in charge of investigating and notifying, and who is held at fault in which cases.
Does a software platform need a BAA?
Yes, especially when the software platform creates, receives, maintains, or transmits PHI on a provider’s behalf. Examples of software platforms that might qualify include analytics platforms, cloud hosting, EHRs, telehealth tools, and email and messaging services.
In cases where a software platform never accesses or handles PHI, then no BAA is required.
Please note that this is only general information, not official legal advice. For guidance on your particular situation, consult a healthcare compliance attorney.
